The goal of this change is to protect us more thoroughly against DNS rebinding attacks and redirects in the icons service, previously we did a manual lookup check before doing the initial HTTP request, which would leave us vulnerable, by inserting a middleware DNS resolver into reqwest we should be protected against all cases.
Also I noticed that with the hickory-resolver crate we can enable DNS over TLS and DNS over HTTPS, which seems like a great option, but we'd need to test further.
Also moved the is_global_ip functions to utils, because it was crowding the already big icons file.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/3988
**Author:** [@dani-garcia](https://github.com/dani-garcia)
**Created:** 10/20/2023
**Status:** ✅ Merged
**Merged:** 4/27/2024
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `icons_dns`
---
### 📝 Commits (2)
- [`7bd2a2b`](https://github.com/dani-garcia/vaultwarden/commit/7bd2a2b74c5c384a9aee36ed27a45ad6621a84ca) Implement custom DNS resolver
- [`c5e6d1f`](https://github.com/dani-garcia/vaultwarden/commit/c5e6d1f511885ef9e140f8c91c84fa3212a8ac5f) Merge branch 'main' into icons_dns
### 📊 Changes
**6 files changed** (+346 additions, -256 deletions)
<details>
<summary>View changed files</summary>
📝 `Cargo.lock` (+5 -5)
📝 `Cargo.toml` (+3 -2)
📝 `src/api/icons.rs` (+85 -237)
📝 `src/api/mod.rs` (+1 -1)
📝 `src/main.rs` (+3 -3)
📝 `src/util.rs` (+249 -8)
</details>
### 📄 Description
The goal of this change is to protect us more thoroughly against DNS rebinding attacks and redirects in the icons service, previously we did a manual lookup check before doing the initial HTTP request, which would leave us vulnerable, by inserting a middleware DNS resolver into reqwest we should be protected against all cases.
Also I noticed that with the `hickory-resolver` crate we can enable DNS over TLS and DNS over HTTPS, which seems like a great option, but we'd need to test further.
Also moved the `is_global_ip` functions to utils, because it was crowding the already big `icons` file.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/3988
Author: @dani-garcia
Created: 10/20/2023
Status: ✅ Merged
Merged: 4/27/2024
Merged by: @dani-garcia
Base:
main← Head:icons_dns📝 Commits (2)
7bd2a2bImplement custom DNS resolverc5e6d1fMerge branch 'main' into icons_dns📊 Changes
6 files changed (+346 additions, -256 deletions)
View changed files
📝
Cargo.lock(+5 -5)📝
Cargo.toml(+3 -2)📝
src/api/icons.rs(+85 -237)📝
src/api/mod.rs(+1 -1)📝
src/main.rs(+3 -3)📝
src/util.rs(+249 -8)📄 Description
The goal of this change is to protect us more thoroughly against DNS rebinding attacks and redirects in the icons service, previously we did a manual lookup check before doing the initial HTTP request, which would leave us vulnerable, by inserting a middleware DNS resolver into reqwest we should be protected against all cases.
Also I noticed that with the
hickory-resolvercrate we can enable DNS over TLS and DNS over HTTPS, which seems like a great option, but we'd need to test further.Also moved the
is_global_ipfunctions to utils, because it was crowding the already bigiconsfile.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.